Home STIG questions Is there a STIG and SCAP benchmark for Amazon Linux 2023?

Is there a STIG and SCAP benchmark for Amazon Linux 2023?

Last updated on Nov 10, 2026

Amazon Linux 2023 (AL2023) has its own DISA STIG. You no longer need to borrow the RHEL 9 STIG for it. This article lists what is available and how to use it with STIG Viewer.

The STIG

  • Name: Amazon Linux 2023 Security Technical Implementation Guide.
  • Current release: Version 1, Release 5. The benchmark date is 2026-08-20, and DISA released it on 30 Sep 2026.
  • Size: 187 rules. 21 are high severity, 163 are medium and 3 are low.
  • History: Version 1, Release 1 has a benchmark date of July 2025. Releases 2, 3 and 4 were released in January, April and July 2026.

Download the STIG from the DISA STIG library, then add it to STIG Viewer and create a checklist from it.

Scanning

SCAP Compliance Checker (SCC) 5.15 lists "Add support for Amazon Linux 2023" in its release notes. The SCC readme says the Linux RPM installer covers RHEL, Oracle Linux, SUSE and Amazon Linux.

  1. Install SCC 5.15 or later on the AL2023 host.
  2. Run a scan with the Amazon Linux 2023 content.
  3. In STIG Viewer, open your AL2023 checklist.
  4. Click the Import icon and select Import XCCDF or CMRS Results.
  5. Load the XCCDF results file and review the match summary.
  6. Click Complete Import.

Common problems

  • Results match on Rule ID but not revision. The scan content and the checklist come from different STIG releases. Build the checklist from the release that matches your SCAP content, or check Include loosely matched results.
  • You scanned with RHEL 9 content. Older workarounds used RHEL 9 content on AL2023. Those results use RHEL rule IDs, so they will not match an AL2023 checklist. Rescan with AL2023 content.
  • OpenSCAP users. Check whether your SCAP Security Guide version includes an AL2023 STIG profile before you rely on it.

Sources